ci: repin conformance harness to published 0.2.0-alpha.10 - #3185
Closed
pcarleton wants to merge 2 commits into
Closed
ci: repin conformance harness to published 0.2.0-alpha.10#3185pcarleton wants to merge 2 commits into
pcarleton wants to merge 2 commits into
Claude / Claude Code Review
completed
Jul 27, 2026 in 10m 15s
Code review found 2 potential issues
Found 1 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 2 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | .github/workflows/conformance.yml:17-26 |
PR description contradicts final diff: sha256 pin and fetch-and-verify steps are kept, not dropped |
Annotations
Check warning on line 26 in .github/workflows/conformance.yml
claude / Claude Code Review
PR description contradicts final diff: sha256 pin and fetch-and-verify steps are kept, not dropped
The PR description says this change points `CONFORMANCE_PKG` back at the registry spec and drops `CONFORMANCE_PKG_SHA256` plus the fetch-and-verify steps, but the head commit (40328e7) deliberately reversed that plan — the final diff keeps the sha256 byte-pin and both fetch-and-verify steps, pointing `CONFORMANCE_PKG` at the registry tarball URL instead. A squash-merge message derived from the description would misstate the supply-chain posture (implying npm's weaker integrity check applies when
Loading